As reported by BleepingComputer, identity gaps continue to expose critical infrastructure operators to significant risk — and the security community needs to treat this as a first-order operational problem, not a theoretical architecture discussion.
The Identity Problem is Worse in Critical Infrastructure Than Anywhere Else
Most enterprise security conversations about identity center on corporate IT environments. But critical infrastructure — power grids, water treatment facilities, pipelines, healthcare systems — faces a fundamentally different threat calculus. Operational technology (OT) and industrial control systems (ICS) were historically air-gapped or minimally connected. That isolation is now largely gone, replaced by remote access capabilities, vendor connections, and hybrid IT/OT architectures that legacy identity controls were never designed to protect.
The result is a dangerous middle ground: connectivity that rivals modern enterprise IT, paired with identity and access management (IAM) practices that often lag by a decade or more. Shared accounts, infrequently rotated credentials, and implicit device trust are not edge cases in these environments — they are the norm.
Shield53 Perspective: When a threat actor compromises a single privileged account in a critical infrastructure environment, the blast radius isn't measured in leaked records — it's measured in physical consequences. That asymmetry demands a fundamentally different approach to identity verification.
Why Credential-Based Attacks Dominate This Threat Landscape
Nation-state actors and sophisticated criminal groups consistently target identity as their primary attack vector in critical infrastructure campaigns — not because it's the only path, but because it's reliably the path of least resistance. Phishing, password spraying, and credential stuffing against internet-exposed remote access portals (VPNs, RDP gateways, vendor jump servers) continue to yield results precisely because many operators haven't closed the gap between who is authenticating and whether that authentication should be trusted.
Device trust is the missing half of this equation. An operator's valid credentials accessing a control system from an unmanaged, compromised device represents a threat that username-and-password verification alone cannot detect. Yet many critical infrastructure environments still rely on single-factor or inconsistently enforced MFA, with no device posture assessment at the point of access.
Zero Trust Architecture: Practical Reality for OT Environments
Zero Trust is often dismissed in OT circles as an enterprise IT concept that doesn't translate to industrial environments. This is a dangerous misconception. The core principle — verify explicitly, assume breach, enforce least privilege — applies with equal or greater force when the protected assets include physical infrastructure. The implementation path simply requires more care around legacy protocols, latency-sensitive systems, and the operational realities of shift-based workforces.
Critical areas where Zero Trust principles must be applied in critical infrastructure:
Regulatory Pressure Is Accelerating — But Compliance Isn't Enough
CISA, NERC CIP, and sector-specific regulators are increasingly explicit about identity requirements for critical infrastructure operators. But regulatory compliance should be treated as a floor, not a ceiling. Many compliant organizations still carry significant identity risk because compliance frameworks often lag behind attacker tradecraft by years. The organizations most resistant to credential-based compromise are those that have internalized identity security as an operational discipline — not just a checkbox exercise.
Shield53 Recommendations
- Audit all privileged accounts across IT and OT environments immediately — including service accounts, vendor accounts, and shared credentials. Eliminate or vault all non-attributable accounts.
- Deploy MFA universally for all remote access pathways. Phishing-resistant MFA (FIDO2/hardware tokens) should be prioritized for high-privilege roles and remote access to OT-adjacent systems.
- Implement continuous password auditing against known breach databases — particularly in Active Directory environments where compromised credentials may persist undetected for months.
- Require device trust signals as a condition of access for all IT/OT boundary systems. Unmanaged or unverified devices should be denied access, not just flagged.
- Map and control all third-party access pathways — vendor and contractor connections should use dedicated, monitored, and time-limited access solutions, never shared credentials or persistent VPN tunnels.
- Conduct tabletop exercises specifically simulating credential compromise scenarios in your OT environment to expose response gaps before an attacker does.
Identity is not a supporting control in critical infrastructure security — it is the primary defensive perimeter. Organizations that treat it as such will be significantly more resilient than those still relying on network boundaries that no longer exist in practice.
